operator: ProvisionToken support

[hugoShaka]

Fixes: #21417

This PR adds a new TeleportProvisionToken CRD reconciled by the kubernetes operator.
This will be used when splitting auth and proxies (see RFD 0096) to create kubernetes provision tokens (see RFD 0094) for the proxies to join.

The CRD generator was not registering nested messages properly, the first commit contains the fix. (it was also swallowing errors)

Note for reviewers: the PR looks huge but you can disregard the big YAML manifests which are not really relevant. I'd love to find a way to improve readability of those PRs.

Blocked by #18659

This PR should be rebased and CRD generation ran again with the new Kubernetes provision tokens.

[github-actions]

@hugoShaka - this PR is large and will require admin approval to merge. Consider breaking it up into a series smaller changes.

[strideynet]

Happy with this once my points & those by Marco have been addressed.

[mdwn]

One small comment, but otherwise pending resolution of the existing feedback, LGTM.

[hugoShaka]

I discovered that tokens, unlike most resources, are forcefully given an expiry.

This happens in the tokenToItem translation:

func (s *ProvisioningService) tokenToItem(p types.ProvisionToken) (*backend.Item, error) {
	if err := p.CheckAndSetDefaults(); err != nil {
		return nil, trace.Wrap(err)
	}
	if p.Expiry().IsZero() || p.Expiry().Sub(s.Clock().Now().UTC()) < time.Second {
		p.SetExpiry(s.Clock().Now().UTC().Add(defaults.ProvisioningTokenTTL))
	}

The operator design relies on the fact resources it creates won't expire. If a token expires, it won't be reconciled immediately (because we don't watch teleport resources events, only kube ones). This might lead to a non-working token for up to 10 hours.

The PR will have to be adapted to support this, the easiest workaround would be to set expiry to a very far date, like in 1000 years.

Edit: I'll likely add an annotation or something specifying the expiry and won't reconcile stuff after the expiry.

[public-teleport-github-review-bot]

@hugoShaka - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

[hugoShaka]

I cherry-picked the changes and applied them on an up-to-date master. Thanks to #21133, we can now create expiry-less tokens in v13, which unlocks the PR. It won't be backportable to v12, but at least v13 users will benefit from the feature.

[public-teleport-github-review-bot]

@hugoShaka See the table below for backport results.

Branch	Result
branch/v13	Create PR